community-platform vulnerabilities

CVEs whose affected-version data names the community-platform package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-116018Medium· 4.3

today

ONEARMY community-platform before 2.165.2 IDOR via notification read endpoint

ONEARMY community-platform before 2.165.2 contains an insecure direct object reference vulnerability that allows authenticated users to mark other users' notifications as read via POST /api/notifications/:id/read. Attackers can iterate s…

▾ SunlitONEARMY · community-platformvia CVEORG